topic Re: ip redirect with PIX in Network Security

ip redirect with PIX

jrhofman — Fri, 21 Feb 2020 07:36:23 GMT

anyone know if you can have a pix do an IP redirect to a host. I had a situation where hosts have a default to the pix on an inside interface and then the pix had a route to the destination via a router on the same inside interface. This breaks down the 3 way handshake since the SYN Ack from the destination never gets sent back throughthe PIX. It just goes directly to the source host on the same subnet.

Re: ip redirect with PIX

scoclayton — Tue, 31 Aug 2004 15:06:06 GMT

Nope. The PIX will not work in this design as you want it to. In order for the PIX to pass packets, the ingress and egress interfaces must be different interfaces. In other words, it must be received on one interface and be placed on the send buffer of another interface in order to pass. This behavior is expected and is part of the Adaptive Security Algorithm (ASA) on the PIX.

Your only real option in this case is to change the DG to the router on the inside segment and add a default route on the router pointing back to the PIX.

Hope this helps.

Scott

Re: ip redirect with PIX

jrhofman — Tue, 31 Aug 2004 18:31:45 GMT

Thanks, That's what I did to fix it but was just curious if I was missing anything in the FW.